Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: how to change color for entire row
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
priya1926
Path Finder
03-08-2022
04:09 AM
my query is
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<table>
<search>
<query>index=*** source=service Name IN (*abc* *def* *ghi* *jkl* *mno*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(Status="Stopped","HIGH",Status="Running","LOW")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">case (match(value,"LOW"), "#DC4E41",match(value,"HIGH"),"#53A051")</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
For the below result where i have "State" as "Stopped" , the entire row should be in Red Color including corresponding Status and Name.
| Name | Status | State |
| abc | OK | Running |
| def | OK | Running |
| hij | OK | Stopped |
| klm | OK | Running |
| nop | OK | Running |
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SanjayReddy
SplunkTrust
03-08-2022
05:50 AM
Hi @priya1926
you missed to add table id and properties of tableColorFinalRowBasedOnData , please find updated code
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SanjayReddy
SplunkTrust
03-08-2022
04:41 AM
Hi @priya1926
there is already one post for same requement , which might helps you
can you please refer to it
https://community.splunk.com/t5/Dashboards-Visualizations/change-the-color-of-row-based-on-cell-valu...
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
priya1926
Path Finder
03-08-2022
05:10 AM
I tired mvindex to get the colour. But i am getting the #code in each field value in the table.
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<table>
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
SanjayReddy
SplunkTrust
03-08-2022
05:50 AM
Hi @priya1926
you missed to add table id and properties of tableColorFinalRowBasedOnData , please find updated code
<dashboard version="1.1">
<label>CCEcolour</label>
<row>
<panel>
<html depends="$alwaysHideHTMLCSSPanel$">
<style>
#tableColorFinalRowBasedOnData table tbody td div.multivalue-subcell[data-mv-index="1"]{
display: none;
}
</style>
</html>
<table id="tableColorFinalRowBasedOnData">
<search>
<query>index="***" source=service Name IN (*abc* *def* *hij* *lmn* *opq*) host IN (xyz) earliest=-60m
| dedup host Name
| table Name Status State | sort Name
| eval color=case(State="Stopped","#FF0000",State="Running","#00FF00")
| foreach Name Status State [ eval <<FIELD>>=mvappend('<<FIELD>>',color)]
| fields - color
</query>
<earliest>-24h@h</earliest>
<latest>now</latest>
<sampleRatio>1</sampleRatio>
</search>
<option name="count">100</option>
<option name="dataOverlayMode">none</option>
<option name="drilldown">none</option>
<option name="percentagesRow">false</option>
<option name="rowNumbers">false</option>
<option name="totalsRow">false</option>
<option name="wrap">true</option>
<format type="color" field="Name">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="Status">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
<format type="color" field="State">
<colorPalette type="expression">mvindex(value,1)</colorPalette>
</format>
</table>
</panel>
</row>
</dashboard>
Get Updates on the Splunk Community!
Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...
This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...
Splunk Community Badges!
Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...
What You Read The Most: Splunk Lantern’s Most Popular Articles!
Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...
